CVE-2026-107284

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1

Description The WebSocketHandler.upgrade() function fails to properly halt the process when a handshake has a missing or invalid Sec-WebSocket-Accept value. Although the handshake is aborted and the request future fails, the system continues with pipeline installation and onOpen delivery. This allows frames coalesced with the invalid 101 response to be decoded and delivered from a peer that has not successfully proven the handshake, even though the channel eventually closes.

Recommendations Update to version 3.0.12 or later. Update to version 2.16.1 or later.